Photo Gallery WordPress Plugin Flaw Allows Arbitrary File Upload

Executive Summary

A high-severity unrestricted file upload vulnerability (CVE-2026-81650, CVSS 7.2) has been disclosed in the Photo Gallery, Sliders, Proofing & Themes plugin for WordPress. Versions before 4.5.0 fail to correctly validate the extensions of files extracted from an uploaded archive because a variable meant to track validation state is reused as a loop counter — so the extension check always passes, regardless of what the archive actually contains.

Any user granted the plugin's gallery-management capability by an administrator can exploit this to write arbitrary files, including PHP scripts, into a web-accessible directory. On hosts that execute uploaded PHP, this results in remote code execution.

Vulnerability Overview

Root Cause

The plugin extracts uploaded ZIP archives to build photo galleries and slider content. During extraction, it is supposed to validate the extension of every file inside the archive before writing it to disk. The validation routine reuses a single variable both to record whether a given file passed the check and as the loop counter iterating over archive entries. Because the counter increments regardless of outcome, the "passed" condition is effectively always true by the time later entries are processed — meaning files with disallowed extensions (.php, .phtml, etc.) slip through the same code path as legitimate images.

Affected Versions

This disclosure is one of several related fixes shipped in the same release; WPScan also assigned CVE-2026-81651, CVE-2026-81652, CVE-2026-81653, and CVE-2026-81654 to neighboring issues found during the same review of the plugin's archive-handling code.

Attack Vector

1. Attacker holds (or is granted) the plugin's gallery-management capability
2. Attacker crafts a ZIP archive containing a malicious PHP file alongside images
3. Archive is uploaded through the plugin's gallery/slider import feature
4. Loop-counter bug causes the extension check to pass for every entry
5. Malicious PHP file is extracted into a web-accessible uploads directory
6. Attacker requests the file directly over HTTP to execute it

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 4.5.0

# Via WP-CLI
wp plugin update photo-gallery
 
# Verify the installed version
wp plugin get photo-gallery --field=version

Or update through Plugins > Installed Plugins in the WordPress admin dashboard.

Step 2: Review Capability Grants

Gallery-management capability should only be granted to trusted users. Audit which roles currently hold it:

wp user list --role=administrator --fields=user_login,roles

Step 3: Scan for Existing Compromise

find /path/to/wordpress/wp-content/uploads/ -name "*.php" -newer /path/to/wordpress/wp-includes/version.php -type f
grep -rl "eval\s*(base64_decode" /path/to/wordpress/wp-content/uploads/
wp core verify-checksums

If Immediate Patching Is Not Possible

1. Disable script execution in upload directories via .htaccess or Nginx deny rules
2. Restrict gallery-management capability to a minimal set of trusted accounts
3. Deploy WAF rules to block archive uploads containing non-image extensions

References

• NVD — CVE-2026-81650
• OffSeq Threat Radar — CVE-2026-81650

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated